shaba/ostree
1
0
Fork 0
mirror of https://github.com/ostreedev/ostree.git synced 2024-12-23 21:35:26 +03:00
Code Issues Projects Releases Wiki Activity
a9df634c47
ostree/tests/test-gpg-verify-result.c

617 lines
20 KiB
C
Raw Normal View History

tree-wide: Remove Emacs modelines We added a `.dir-locals.el` in commit: 9a77017d87b74c5e2895cdd64ad098018929403f There's no need to have it per-file, with that people might think to add other editors, which is the wrong direction. Closes: #1206 Approved by: jlebon
2017-09-21 22:26:06 +03:00
/*
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
* Copyright (C) 2015 Red Hat, Inc.
*
Add SPDX-License-Identifier to source files SPDX License List is a list of (common) open source licenses that can be referred to by a “short identifier”. It has several advantages compared to the common "license header texts" usually found in source files. Some of the advantages: * It is precise; there is no ambiguity due to variations in license header text * It is language neutral * It is easy to machine process * It is concise * It is simple and can be used without much cost in interpreted environments like java Script, etc. * An SPDX license identifier is immutable. * It provides simple guidance for developers who want to make sure the license for their code is respected See http://spdx.org for further reading. Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com> Closes: #1439 Approved by: cgwalters
2018-01-30 22:26:26 +03:00
* SPDX-License-Identifier: LGPL-2.0+
*
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the
* Free Software Foundation, Inc., 59 Temple Place - Suite 330,
* Boston, MA 02111-1307, USA.
*/
#include "config.h"
#include <gpgme.h>
Final excision of libgsystem dependency Lots and lots of preparation led to this moment - when nothing apparent changes for users! Woo! But seriously, having the extra dependency is a minor annoyance, and in the big picture I think the libgsystem idea was wrong - we need to land things in GLib, and use git submodules for API-unstable or Linux-specific sharing. For a lot of OSTree, the libgsystem `GFile*` orientation was also wrong, we really want fd-relative. Closes: #444 Approved by: jlebon
2016-06-23 03:12:31 +03:00
#include "libglnx.h"
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
#include "ostree-gpg-verify-result-private.h"
#define assert_no_gpg_error(err, filename) \
G_STMT_START { \
if (err != GPG_ERR_NO_ERROR) { \
tree-wide: Convert to using autoptr(GString) vs g_string_free(...,TRUE) If we're freeing the segment, it's basically always better to use `autoptr()`. Fewer lines, more reliable, etc. Noticed an instance of this in the pull code while reviewing a different PR, decided to do a grep for it and fix it tree wide. Closes: #836 Approved by: pwithnall
2017-05-05 17:44:49 +03:00
g_autoptr(GString) string = g_string_new ("assertion failed "); \
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_string_append_printf (string, "%s: %s ", gpgme_strsource (err), gpgme_strerror (err)); \
g_string_append (string, filename ? filename : ""); \
g_assertion_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, string->str); \
} \
} G_STMT_END
tests/gpg: Test ostree_gpg_verify_result_require_valid_signature Add explicit tests for `ostree_gpg_verify_result_require_valid_signature` in addition to the implicit tests via `ostree pull` and others. This allows checking the error code raised.
2019-06-21 14:16:13 +03:00
#define assert_str_contains(s1, s2) \
G_STMT_START { \
const char *__s1 = (s1), *__s2 = (s2); \
if (strstr (__s1, __s2) == NULL) { \
g_autoptr(GString) string = g_string_new ("assertion failed (" #s1 " contains " #s2 "): "); \
g_autofree char *__es1 = g_strescape (__s1, NULL); \
g_autofree char *__es2 = g_strescape (__s2, NULL); \
g_string_append_printf (string, "(\"%s\", \"%s\")", __es1, __es2); \
g_assertion_message (G_LOG_DOMAIN, __FILE__, __LINE__, G_STRFUNC, string->str); \
} \
} G_STMT_END
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
typedef struct {
OstreeGpgVerifyResult *result;
} TestFixture;
static OstreeGpgSignatureAttr some_attributes[] = {
OSTREE_GPG_SIGNATURE_ATTR_VALID,
OSTREE_GPG_SIGNATURE_ATTR_SIG_EXPIRED,
OSTREE_GPG_SIGNATURE_ATTR_KEY_EXPIRED,
OSTREE_GPG_SIGNATURE_ATTR_KEY_REVOKED,
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
OSTREE_GPG_SIGNATURE_ATTR_KEY_MISSING,
OSTREE_GPG_SIGNATURE_ATTR_KEY_EXP_TIMESTAMP,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
};
static void
test_fixture_setup (TestFixture *fixture,
gconstpointer user_data)
{
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
const char * const *sig_files = user_data;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gpgme_error_t gpg_error;
gpgme_data_t data_buffer;
gpgme_data_t signature_buffer;
OstreeGpgVerifyResult *result;
Use g_autofree instead of gs_free
2015-05-05 00:58:26 +03:00
g_autofree char *homedir = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
GError *local_error = NULL;
/* Mimic what OstreeGpgVerifier does to create OstreeGpgVerifyResult.
* We don't use OstreeGpgVerifier directly because we don't need the
* multiple-keyring workaround and because we want the trust database
* taken into account, which contains additional data like revocation
* certificates for certain test cases. */
tests: Port to glib-tap.mk, make `make check` run all of the tests OSTree's code for testing predates the `glib-tap.mk` making its way into GLib. Let's switch to it, as it provides a number of advantages. By far the biggest advantage is that `make check` can start to run most of the tests *in addition* to having them work installed. This commit keeps the installed tests working, but `make check` turns out to be really broken because...our TAP usage has bitrotted to say the least. Fix that all up. Do some hacks so that the tests work uninstalled as well - in particular, `glib-tap.mk` and the bits encoded into `g_test_build_filename()` assume *recursive* Automake (blah). Work around that by creating a symlink when installed to loop back.
2016-03-02 18:28:04 +03:00
homedir = g_test_build_filename (G_TEST_DIST, "tests/gpg-verify-data", NULL);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_setenv ("GNUPGHOME", homedir, TRUE);
result = g_initable_new (OSTREE_TYPE_GPG_VERIFY_RESULT,
NULL, &local_error, NULL);
g_assert_no_error (local_error);
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
g_autofree char *data_filename = g_build_filename (homedir, "lgpl2", NULL);
gpg_error = gpgme_data_new_from_file (&data_buffer, data_filename, 1);
assert_no_gpg_error (gpg_error, data_filename);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
if (sig_files == NULL)
{
/* No signature files specified, use full lgpl2.sig file */
g_autofree char *filename = g_build_filename (homedir, "lgpl2.sig", NULL);
gpg_error = gpgme_data_new_from_file (&signature_buffer, filename, 1);
assert_no_gpg_error (gpg_error, filename);
}
else
{
/* Read all the specified files into the signature buffer */
gpg_error = gpgme_data_new (&signature_buffer);
assert_no_gpg_error (gpg_error, NULL);
for (const char * const *name = sig_files; *name != NULL; name++)
{
g_autofree char *path = g_build_filename (homedir, *name, NULL);
g_autoptr(GFile) sig_file = g_file_new_for_path (path);
g_autofree char *contents = NULL;
gsize len;
g_assert_true (g_file_load_contents (sig_file, NULL, &contents,
&len, NULL, &local_error));
g_assert_no_error (local_error);
char *cur = contents;
while (len > 0)
{
ssize_t written = gpgme_data_write (signature_buffer, cur, len);
if (written == -1)
assert_no_gpg_error (gpgme_error_from_syserror (), path);
cur += written;
len -= written;
}
}
gpgme_data_seek (signature_buffer, 0, SEEK_SET);
}
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gpg_error = gpgme_op_verify (result->context,
signature_buffer, data_buffer, NULL);
assert_no_gpg_error (gpg_error, NULL);
result->details = gpgme_op_verify_result (result->context);
gpgme_result_ref (result->details);
gpgme_data_release (data_buffer);
gpgme_data_release (signature_buffer);
fixture->result = result;
}
static void
test_fixture_teardown (TestFixture *fixture,
gconstpointer user_data)
{
g_clear_object (&fixture->result);
}
static void
test_check_counts (TestFixture *fixture,
gconstpointer user_data)
{
guint count_all;
guint count_valid;
count_all = ostree_gpg_verify_result_count_all (fixture->result);
count_valid = ostree_gpg_verify_result_count_valid (fixture->result);
g_assert_cmpint (count_all, ==, 5);
tests/gpg-verify-data: Empty out trustdb.gpg When the private keys were generated, gpg added an ultimate trust entry since you normally want to trust your own keys. However, this throws off the expired signature testing since gpgme considers it valid if the key is fully or ultimately trusted. The use of a trustdb for the test-gpg-verify-result is unlike any other GPG verification in ostree. Under normal circumstances, a temporary GPG homedir is created without any trust information, so all keys are treated as having unknown trust. Regenerate an empty trustdb.gpg in gpg-verify-data so that the tests behave as ostree normally operates. After this the expired signature testing correctly shows up as a non-valid signature. The trustdb was regenerated by simply removing it and running any gpg operation with the gpg-verify-data directory as the homedir.
2019-06-21 15:09:43 +03:00
g_assert_cmpint (count_valid, ==, 1);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
}
static void
test_signature_lookup (TestFixture *fixture,
gconstpointer user_data)
{
/* Checking the signature with the revoked key for this case. */
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
guint expected_signature_index = 2;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
/* Lowercase letters to ensure OstreeGpgVerifyResult handles it. */
gpg: Regenerate test data for test-gpg-verify-result Turns out the expired signature case was failing because the signature itself was corrupted. Reconstructed the test data and updated the test code. Note, an expired signature is still counted as valid. Also, handy debugging trick for setting a key or signature expiry: the CLI makes it appear the shortest expiry is 1 day, but it also secretly recognizes "seconds=N".
2015-03-19 19:43:04 +03:00
const char *fingerprint = "68dcc2db4bec5811c2573590bd9d2a44b7f541a6";
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
guint signature_index;
gboolean signature_found;
/* Lookup full fingerprint. */
signature_index = 999999;
signature_found = ostree_gpg_verify_result_lookup (fixture->result,
fingerprint,
&signature_index);
g_assert_true (signature_found);
g_assert_cmpint (signature_index, ==, expected_signature_index);
/* Lookup abbreviated key ID. */
signature_index = 999999;
signature_found = ostree_gpg_verify_result_lookup (fixture->result,
fingerprint + 32,
&signature_index);
g_assert_true (signature_found);
g_assert_cmpint (signature_index, ==, expected_signature_index);
/* Bogus fingerprint, index should remain unchanged. */
signature_index = expected_signature_index = 999999;
fingerprint = "CAFEBABECAFEBABECAFEBABECAFEBABECAFEBABE";
signature_found = ostree_gpg_verify_result_lookup (fixture->result,
fingerprint,
&signature_index);
g_assert_false (signature_found);
g_assert_cmpint (signature_index, ==, expected_signature_index);
}
static void
test_attribute_basics (TestFixture *fixture,
gconstpointer user_data)
{
guint n_signatures, ii;
n_signatures = ostree_gpg_verify_result_count_valid (fixture->result);
for (ii = 0; ii < n_signatures; ii++)
{
Use g_autoptr(GVariant) instead of gs_unref_variant
2015-05-05 18:45:46 +03:00
g_autoptr(GVariant) tuple = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
const char *attr_string;
const char *type_string;
gboolean key_missing;
tuple = ostree_gpg_verify_result_get_all (fixture->result, ii);
type_string = g_variant_get_type_string (tuple);
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_assert_cmpstr (type_string, ==, "(bbbbbsxxsssssxx)");
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
/* Check attributes which should be common to all signatures. */
g_variant_get_child (tuple,
OSTREE_GPG_SIGNATURE_ATTR_PUBKEY_ALGO_NAME,
"&s", &attr_string);
g_assert_cmpstr (attr_string, ==, "RSA");
g_variant_get_child (tuple,
OSTREE_GPG_SIGNATURE_ATTR_HASH_ALGO_NAME,
"&s", &attr_string);
g_assert_cmpstr (attr_string, ==, "SHA1");
g_variant_get_child (tuple,
OSTREE_GPG_SIGNATURE_ATTR_KEY_MISSING,
"b", &key_missing);
g_variant_get_child (tuple,
OSTREE_GPG_SIGNATURE_ATTR_USER_NAME,
"&s", &attr_string);
if (key_missing)
g_assert_cmpstr (attr_string, ==, "[unknown name]");
else
g_assert_cmpstr (attr_string, ==, "J. Random User");
g_variant_get_child (tuple,
OSTREE_GPG_SIGNATURE_ATTR_USER_EMAIL,
"&s", &attr_string);
if (key_missing)
g_assert_cmpstr (attr_string, ==, "[unknown email]");
else
g_assert_cmpstr (attr_string, ==, "testcase@redhat.com");
}
}
static void
test_valid_signature (TestFixture *fixture,
gconstpointer user_data)
{
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
guint signature_index = 0;
Use g_autoptr(GVariant) instead of gs_unref_variant
2015-05-05 18:45:46 +03:00
g_autoptr(GVariant) tuple = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gboolean valid;
gboolean sig_expired;
gboolean key_expired;
gboolean key_revoked;
gboolean key_missing;
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
gint64 key_exp_timestamp;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tuple = ostree_gpg_verify_result_get (fixture->result,
signature_index,
some_attributes,
G_N_ELEMENTS (some_attributes));
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_variant_get (tuple, "(bbbbbx)",
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
&valid,
&sig_expired,
&key_expired,
&key_revoked,
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
&key_missing,
&key_exp_timestamp);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_assert_true (valid);
g_assert_false (sig_expired);
g_assert_false (key_expired);
g_assert_false (key_revoked);
g_assert_false (key_missing);
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_assert_cmpint (key_exp_timestamp, ==, 0);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
}
static void
test_expired_key (TestFixture *fixture,
gconstpointer user_data)
{
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
guint signature_index = 1;
Use g_autoptr(GVariant) instead of gs_unref_variant
2015-05-05 18:45:46 +03:00
g_autoptr(GVariant) tuple = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gboolean valid;
gboolean sig_expired;
gboolean key_expired;
gboolean key_revoked;
gboolean key_missing;
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
gint64 key_exp_timestamp;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tuple = ostree_gpg_verify_result_get (fixture->result,
signature_index,
some_attributes,
G_N_ELEMENTS (some_attributes));
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_variant_get (tuple, "(bbbbbx)",
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
&valid,
&sig_expired,
&key_expired,
&key_revoked,
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
&key_missing,
&key_exp_timestamp);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_assert_false (valid);
g_assert_false (sig_expired);
g_assert_true (key_expired);
g_assert_false (key_revoked);
g_assert_false (key_missing);
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_assert_cmpint (key_exp_timestamp, ==, 1426782201);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
}
static void
test_revoked_key (TestFixture *fixture,
gconstpointer user_data)
{
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
guint signature_index = 2;
Use g_autoptr(GVariant) instead of gs_unref_variant
2015-05-05 18:45:46 +03:00
g_autoptr(GVariant) tuple = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gboolean valid;
gboolean sig_expired;
gboolean key_expired;
gboolean key_revoked;
gboolean key_missing;
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
gint64 key_exp_timestamp;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tuple = ostree_gpg_verify_result_get (fixture->result,
signature_index,
some_attributes,
G_N_ELEMENTS (some_attributes));
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_variant_get (tuple, "(bbbbbx)",
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
&valid,
&sig_expired,
&key_expired,
&key_revoked,
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
&key_missing,
&key_exp_timestamp);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_assert_false (valid);
g_assert_false (sig_expired);
g_assert_false (key_expired);
g_assert_true (key_revoked);
g_assert_false (key_missing);
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_assert_cmpint (key_exp_timestamp, ==, 0);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
}
static void
test_missing_key (TestFixture *fixture,
gconstpointer user_data)
{
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
guint signature_index = 3;
Use g_autoptr(GVariant) instead of gs_unref_variant
2015-05-05 18:45:46 +03:00
g_autoptr(GVariant) tuple = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gboolean valid;
gboolean sig_expired;
gboolean key_expired;
gboolean key_revoked;
gboolean key_missing;
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
gint64 key_exp_timestamp;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tuple = ostree_gpg_verify_result_get (fixture->result,
signature_index,
some_attributes,
G_N_ELEMENTS (some_attributes));
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_variant_get (tuple, "(bbbbbx)",
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
&valid,
&sig_expired,
&key_expired,
&key_revoked,
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
&key_missing,
&key_exp_timestamp);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_assert_false (valid);
g_assert_false (sig_expired);
g_assert_false (key_expired);
g_assert_false (key_revoked);
g_assert_true (key_missing);
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_assert_cmpint (key_exp_timestamp, ==, 0);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
}
static void
test_expired_signature (TestFixture *fixture,
gconstpointer user_data)
{
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
guint signature_index = 4;
Use g_autoptr(GVariant) instead of gs_unref_variant
2015-05-05 18:45:46 +03:00
g_autoptr(GVariant) tuple = NULL;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
gboolean valid;
gboolean sig_expired;
gboolean key_expired;
gboolean key_revoked;
gboolean key_missing;
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
gint64 key_exp_timestamp;
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tuple = ostree_gpg_verify_result_get (fixture->result,
signature_index,
some_attributes,
G_N_ELEMENTS (some_attributes));
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_variant_get (tuple, "(bbbbbx)",
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
&valid,
&sig_expired,
&key_expired,
&key_revoked,
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
&key_missing,
&key_exp_timestamp);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
tests/gpg-verify-data: Empty out trustdb.gpg When the private keys were generated, gpg added an ultimate trust entry since you normally want to trust your own keys. However, this throws off the expired signature testing since gpgme considers it valid if the key is fully or ultimately trusted. The use of a trustdb for the test-gpg-verify-result is unlike any other GPG verification in ostree. Under normal circumstances, a temporary GPG homedir is created without any trust information, so all keys are treated as having unknown trust. Regenerate an empty trustdb.gpg in gpg-verify-data so that the tests behave as ostree normally operates. After this the expired signature testing correctly shows up as a non-valid signature. The trustdb was regenerated by simply removing it and running any gpg operation with the gpg-verify-data directory as the homedir.
2019-06-21 15:09:43 +03:00
g_assert_false (valid);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
g_assert_true (sig_expired);
g_assert_false (key_expired);
g_assert_false (key_revoked);
g_assert_false (key_missing);
lib/gpg: Show information for expired keys Introduce a new signature attribute for the key expiration timestamp and display it when the key has a non-zero expiration time. Without this, the error shown is `BAD signature`, which isn't correct. Closes: #1872 Approved by: cgwalters
2019-06-10 20:05:21 +03:00
g_assert_cmpint (key_exp_timestamp, ==, 0);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
}
tests/gpg: Test ostree_gpg_verify_result_require_valid_signature Add explicit tests for `ostree_gpg_verify_result_require_valid_signature` in addition to the implicit tests via `ostree pull` and others. This allows checking the error code raised.
2019-06-21 14:16:13 +03:00
static void
test_require_valid_signature (TestFixture *fixture,
gconstpointer user_data)
{
GError *error = NULL;
gboolean res = ostree_gpg_verify_result_require_valid_signature (fixture->result,
&error);
g_assert_true (res);
g_assert_no_error (error);
}
static void
test_require_valid_signature_expired_key (TestFixture *fixture,
gconstpointer user_data)
{
GError *error = NULL;
gboolean res = ostree_gpg_verify_result_require_valid_signature (fixture->result,
&error);
g_assert_false (res);
g_assert_error (error, OSTREE_GPG_ERROR, OSTREE_GPG_ERROR_EXPIRED_KEY);
assert_str_contains (error->message, "Key expired");
}
static void
test_require_valid_signature_revoked_key (TestFixture *fixture,
gconstpointer user_data)
{
GError *error = NULL;
gboolean res = ostree_gpg_verify_result_require_valid_signature (fixture->result,
&error);
g_assert_false (res);
g_assert_error (error, OSTREE_GPG_ERROR, OSTREE_GPG_ERROR_REVOKED_KEY);
assert_str_contains (error->message, "Key revoked");
}
static void
test_require_valid_signature_missing_key (TestFixture *fixture,
gconstpointer user_data)
{
GError *error = NULL;
gboolean res = ostree_gpg_verify_result_require_valid_signature (fixture->result,
&error);
g_assert_false (res);
g_assert_error (error, OSTREE_GPG_ERROR, OSTREE_GPG_ERROR_MISSING_KEY);
assert_str_contains (error->message, "public key not found");
}
static void
test_require_valid_signature_expired_signature (TestFixture *fixture,
gconstpointer user_data)
{
GError *error = NULL;
gboolean res = ostree_gpg_verify_result_require_valid_signature (fixture->result,
&error);
g_assert_false (res);
g_assert_error (error, OSTREE_GPG_ERROR, OSTREE_GPG_ERROR_EXPIRED_SIGNATURE);
assert_str_contains (error->message, "Signature expired");
}
static void
test_require_valid_signature_expired_missing_key (TestFixture *fixture,
gconstpointer user_data)
{
GError *error = NULL;
gboolean res = ostree_gpg_verify_result_require_valid_signature (fixture->result,
&error);
g_assert_false (res);
/*
* The error will be for the last signature, which is for a missing key, but
* the message should show both issues.
*/
g_assert_error (error, OSTREE_GPG_ERROR, OSTREE_GPG_ERROR_MISSING_KEY);
assert_str_contains (error->message, "Key expired");
assert_str_contains (error->message, "public key not found");
}
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
int
main (int argc, char **argv)
{
g_test_init (&argc, &argv, NULL);
(void) gpgme_check_version (NULL);
g_test_add ("/gpg-verify-result/check-counts",
TestFixture,
NULL,
test_fixture_setup,
test_check_counts,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/signature-lookup",
TestFixture,
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
NULL,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
test_fixture_setup,
test_signature_lookup,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/attribute-basics",
TestFixture,
NULL,
test_fixture_setup,
test_attribute_basics,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/valid-signature",
TestFixture,
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
NULL,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
test_fixture_setup,
test_valid_signature,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/expired-key",
TestFixture,
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
NULL,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
test_fixture_setup,
test_expired_key,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/revoked-key",
TestFixture,
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
NULL,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
test_fixture_setup,
test_revoked_key,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/missing-key",
TestFixture,
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
NULL,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
test_fixture_setup,
test_missing_key,
test_fixture_teardown);
g_test_add ("/gpg-verify-result/expired-signature",
TestFixture,
tests/test-gpg-verify-result: Allow specifying signature files Currently tests are always run against the full lgpl2.sig file with all signatures, but it should also be possible to specify one or more of the individual lgpgl2.sig<N> files. Drop the current usage of passing the signature index in the test data since it's always specific to the test function and instead provide an optional array of signature files for the test fixture to sign with.
2019-06-20 17:32:13 +03:00
NULL,
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
test_fixture_setup,
test_expired_signature,
test_fixture_teardown);
tests/gpg: Test ostree_gpg_verify_result_require_valid_signature Add explicit tests for `ostree_gpg_verify_result_require_valid_signature` in addition to the implicit tests via `ostree pull` and others. This allows checking the error code raised.
2019-06-21 14:16:13 +03:00
g_test_add ("/gpg-verify-result/require-valid-signature",
TestFixture,
NULL,
test_fixture_setup,
test_require_valid_signature,
test_fixture_teardown);
const char *expired_key_files[] = { "lgpl2.sig1", NULL };
g_test_add ("/gpg-verify-result/require-valid-signature-expired-key",
TestFixture,
expired_key_files,
test_fixture_setup,
test_require_valid_signature_expired_key,
test_fixture_teardown);
const char *revoked_key_files[] = { "lgpl2.sig2", NULL };
g_test_add ("/gpg-verify-result/require-valid-signature-revoked-key",
TestFixture,
revoked_key_files,
test_fixture_setup,
test_require_valid_signature_revoked_key,
test_fixture_teardown);
const char *missing_key_files[] = { "lgpl2.sig3", NULL };
g_test_add ("/gpg-verify-result/require-valid-signature-missing-key",
TestFixture,
missing_key_files,
test_fixture_setup,
test_require_valid_signature_missing_key,
test_fixture_teardown);
const char *expired_signature_files[] = { "lgpl2.sig4", NULL };
g_test_add ("/gpg-verify-result/require-valid-signature-expired-signature",
TestFixture,
expired_signature_files,
test_fixture_setup,
test_require_valid_signature_expired_signature,
test_fixture_teardown);
const char *expired_missing_key_files[] = { "lgpl2.sig1", "lgpl2.sig3", NULL };
g_test_add ("/gpg-verify-result/require-valid-signature-expired-missing-key",
TestFixture,
expired_missing_key_files,
test_fixture_setup,
test_require_valid_signature_expired_missing_key,
test_fixture_teardown);
gpg: Add OstreeGpgVerifyResult Wrappers a referenced gpgme_verify_result_t so detailed verify results can be examined independently of executing a verify operation. _ostree_gpg_verifier_check_signature() now returns this object instead of a single valid/invalid boolean, but the idea is for OstreeRepo to also return this object for commit signature verification so it can be utilized at the CLI layer (and possibly by other programs).
2015-03-04 20:44:47 +03:00
return g_test_run ();
}
Reference in New Issue Copy Permalink